On April 15, and again on May 2, President Donald Trump called for the revocation of Harvard University’s 501(c)(3) tax-exempt status.[1] The news came as environmental groups were grappling with rampant rumors that the Trump administration was moving—reportedly through an executive order that was to be issued on Earth Day (April 22)—to redefine the Internal Revenue Service (“IRS”) qualifications for 501(c)(3) tax-exempt status in a way that would exclude conservation and climate nonprofits. That did not happen, and the White House disavowed the rumors. However, on April 24, the interim U.S. attorney for the District of Columbia wrote to the Wikimedia Foundation, the nonprofit that runs Wikipedia, questioning its 501(c)(3) tax-exemption eligibility.
All of this follows President Trump’s March 7 executive order on the federal Public Service Loan Forgiveness program, which ordered the U.S. secretary of education to propose regulations that exclude from the program nonprofit organizations that the administration believes do not qualify for 501(c)(3) tax-exempt status due to having a “substantial illegal purpose.” The executive order defines activities with a “substantial illegal purpose” to include those that aid or abet violations of federal immigration laws, support terrorism, aid or abet illegal discrimination, or violate state tort laws (including those against trespassing, disorderly conduct, or public nuisance), among others. In April, Ed Blum’s American Alliance for Equal Rights filed complaints with the IRS asking the Service to audit and revoke the tax-exempt status of the Gates Foundation and two other 501(c)(3) foundations due to their race-restricted scholarship programs—and the Gates Foundation changed its program just days later. Finally, a March 24 editorial by a Wall Street Journal editor called for the IRS to audit and revoke the exempt status of 501(c)(3) organizations that engage in “illegal” diversity, equity, and inclusion (“DEI”) activities as one of their principal purposes.
While these announcements have sent a wave of fear, apprehension, and alarm through wide swaths of the nonprofit sector, it is important to note that the president, the Justice Department, the Treasury Department, the U.S. attorney for the District of Columbia, and even the IRS do not have the ability to revoke the federal tax-exempt status of any entity through executive order or with the mere stroke of a pen.[2] There are well-established procedures for revoking federal tax exemption, and they all involve the IRS. As described below, with a few exceptions (such as automatic revocation for failure to file an IRS Form 990 for three years in a row), those procedures require individual, case-by-case IRS audits of each organization, with ample opportunity for the entity to defend itself and multiple routes of appeal. There simply is no lawful mechanism for the president, other members of the Trump administration, or the IRS to revoke the tax-exempt status of multiple nonprofits—or even a single nonprofit—without following this longstanding process.
Note that nonprofit organizations are generally organized and operated as both nonprofit and tax-exempt entities. “Nonprofit” status refers to incorporation status under state corporate law; “tax-exempt” status refers to federal income tax exemption under the Internal Revenue Code (“IRC”). Even if, following the IRS audit and appeal process (and any ensuing litigation), an organization’s tax-exempt status is revoked, it still remains a nonprofit corporation (albeit a taxable one). Even post-revocation, the IRS has no authority to shut down a nonprofit, seize its assets, or otherwise take control of the organization.
If the IRS questions the federal tax-exempt status of a nonprofit organization, it can initiate an audit (technically called an “examination”) of the organization, auditing one or more IRS Forms 990 that were filed by the entity. For the tax years under examination, the IRS is effectively determining whether the Forms 990 at issue were accurate and reflected full compliance with the applicable tax laws. For 501(c)(3) tax-exempt organizations (which comprise the vast majority of tax-exempt entities), there can be many bases for threats to their exempt status, including not meeting the “organizational” or “operational” tests, being found to engage in private inurement or impermissible private benefit, having a substantial nonexempt purpose, engaging in too much lobbying, engaging in prohibited political campaign activity, or having too much unrelated business income, among others.
The IRS conducts several types of audits of tax-exempt organizations. The two most common are correspondence examinations and field examinations, the latter of which is much more invasive, involving one or more auditors on site reviewing information and documents and conducting interviews. Field exams generally take several months to conduct, at a minimum, and often much longer.
There are four potential outcomes of an IRS examination of an exempt organization: a no-change letter, a no-change letter with written advisories, a negotiated closing agreement, or a proposed revocation of exempt status. The first three outcomes enable the organization to retain its tax-exempt status, but in the second or third options, with certain conditions or required changes.
If the IRS concludes an audit with a proposed revocation, the organization has thirty days (or longer if an extension is negotiated) to “protest” the proposed ruling and avail itself of the IRS appeals process.[3] During the pendency of the IRS appeal, the organization remains tax-exempt, and during the pendency of the audit and appeal process, the IRS is barred by law from disclosing anything publicly about the matter. Once the protest is filed, it will be assigned to an IRS appeals officer, and the organization (and/or its representatives) will have the opportunity to have an appeals conference to make its case for denying the proposed revocation or otherwise proposing a settlement. The appeals conference is an informal meeting between the organization’s representatives and the appeals officer; the IRS agent who conducted the underlying examination does not participate in the conference. The appeals officer (with the approval of their manager) has broad authority to order the IRS division conducting the examination to issue a no-change letter or no-change letter with written advisories, to negotiate a settlement with the organization, or to finalize the revocation.
If the IRS appeals officer decides to uphold the proposed revocation, the organization will be issued a final adverse determination letter, at which point the entity will have lost its federal tax exemption. The revocation will be published in the Federal Register. Following receipt of the letter, the organization will have ninety days to petition the U.S. Tax Court, the U.S. Court of Federal Claims, or the U.S. District Court for the District of Columbia for a declaratory judgment as to its qualification for tax-exempt status. Like other federal litigation, if unsuccessful at the lower court level, the nonprofit organization or the IRS are permitted to appeal to higher courts. Note that if the court petition is filed prior to the issuance of the final adverse determination letter, the IRS is not permitted to revoke the organization’s tax-exempt status during the pendency of the litigation. However, the IRC provides that a court may not issue a declaratory judgment unless the court determines that the organization has exhausted its administrative remedies. If a protest is not filed with the IRS Appeals Office with respect to an adverse determination, the court may determine that the organization has not exhausted its administrative remedies.
If, at the end of the process, the nonprofit loses its federal tax-exempt status, as stated above, it still remains a private nonprofit corporation, just a taxable one, required to file IRS Form 1120 (the federal corporate tax return) annually and pay federal (and state, if applicable) corporate income tax on its net annual income. Of course, if the nonprofit makes the necessary conforming changes to its organization or operations, it always has the option to prospectively reapply to the IRS for recognition of its 501(c)(3) tax-exempt status. It also has the option to transfer its assets to an existing 501(c)(3) entity or to a newly created 501(c)(3) organization, following which it can then dissolve (once all outstanding liabilities have been satisfied).
The views expressed herein are solely those of the author and are not necessarily those of the author’s firm, the American Bar Association, or the Business Law Section.
Note that federal law (26 U.S.C. § 7217) prohibits senior officials of the executive branch, including the president, from requesting that the Internal Revenue Service (“IRS”) conduct or cease an audit or other investigation of any taxpayer (including tax-exempt entities). There is an exception for written requests by the secretary of the treasury to the IRS as a consequence of the implementation of a change in tax policy. ↑
Congress would seemingly have such authority, but, to date, such legislative action has not been publicly contemplated. ↑
SeeInternal Revenue Serv., IRS Publication 892, How to Appeal an IRS Determination on Tax-Exempt Status (Feb. 2017). ↑
As more state legislatures introduce legislation expanding the reach of their antitrust laws and state attorneys general ramp up their use of antitrust investigations and litigation, the legal landscape continues to become more complex for companies and the courts. Recently, the California enforcers filed an appeal in Association for Accessible Medicines v. Becerra,[1] of a federal judge’s limiting the extraterritorial reach of California’s Assembly Bill 824[2] (“A.B. 824”).
A.B. 824, signed by Governor Gavin Newsom in 2019, attempts to ban settlements between generic and brand pharmaceutical manufacturers colloquially known as “reverse payment” settlements. These sorts of settlements arise when a generic manufacturer takes steps to launch a drug product despite the branded manufacturer’s claim to market exclusivity by virtue of its patent protections over that drug. A reverse payment settlement commonly involves a brand pharmaceutical manufacturer offering something of value to a generic manufacturer in exchange for the generic manufacturer’s agreement to delay its market entry until a certain date in the future.
In Federal Trade Commission v. Actavis, Inc.,[3] the U.S. Supreme Court examined the legal standard that applies to reverse payment settlements, holding that the agreements should be evaluated under the rule of reason. California’s A.B. 824 was enacted in response, and it categorically deemed these agreements anticompetitive as a matter of law and provided for fines of up to $20 million or three times the amount received by the violator in striking the deal—whichever is larger.
In August 2020, the Association for Accessible Medicines (“AAM”), a trade group representing generic pharmaceutical manufacturers, sued the State of California, arguing the law was unconstitutional. In December 2021, the court entered a preliminary injunction, prohibiting enforcement of A.B. 824 pending resolution of the instant lawsuit. In February 2022, the injunction was modified to permit the state to enforce the law only as to “settlement agreements negotiated, completed, or entered into within California’s borders.”
In February 2025, the court entered an order resolving cross-motions for summary judgment, effectively permanently memorializing the state of affairs created by the February 2022 injunction. The court held that A.B. 824 did indeed violate the dormant Commerce Clause insofar as it purported to regulate settlement agreements that had absolutely no connection to California. Accordingly, the court held that the state may enforce the law only as to “settlement agreements negotiated, completed, or entered into within California’s borders.” The order permanently enjoined the state from enforcing A.B. 824 with respect to any settlement agreement that lacked such a connection to California.
At first blush, the order appears to be a victory for the AAM and its member manufacturers. It would seem that so long as generic manufacturers steer clear of negotiating, completing, or executing reverse payment agreements within California borders, they will remain out of the reach of the fines and penalties codified in A.B. 824.
It is unclear whether the pending appeal will resolve two key issues raised by the order. First, the court expressed its concern that A.B. 824, on its face, permitted California to regulate conduct that had no connection to the state whatsoever. In response, the state attempted to argue that this was not the case, asserting A.B. 824 applied only to settlements that cover drug sales in California. With this limitation, the state suggested that A.B. 824 targeted only settlements with some demonstrable connection to California. The court ultimately rejected this argument—not because the sales connection was too tenuous, but solely because the text of A.B. 824, on its face, did not include a limitation to only settlements involving California sales of pharmaceuticals. Thus, the court has left open the proverbial door for California—and other states—to amend A.B. 824 and similar laws to include a sales limitation. In the absence of a full-throated analysis of this defense, it is unclear whether such a limitation would allow for a broader application of A.B. 824 than that permitted by the instant order, one which would undoubtedly trouble the AAM and its members.
Second, the state argued that it should be permitted to enforce A.B. 824 because many states across the country maintain antitrust statutes that already prohibit conduct akin to that regulated by this particular law. The court quickly dispensed with this argument, noting that no state may enforce antitrust legislation ultimately found to violate the dormant Commerce Clause. To the extent challenges are brought, the question of the constitutionality of these state antitrust laws may well boil down to whether the law contains sufficient limiting language so as to target only that unlawful conduct that bears some connection to the subject state.
It unlikely that California’s appeal will resolve the risk for market participants. For example the district court’s order may act as a catalyst for suits challenging the breadth of similar state antitrust laws across the country. In particular, the order leaves ambiguous the potential for California—or other states—to expand the breadth of these antitrust laws by including language that would tie their enforcement to activity that involves sales in the subject state. The growing number of state-level premerger notification requirements and new and amended statutes aimed at expanding the scope of the antitrust laws to conduct not deemed per se illegal under the federal law, or at making it easier for private plaintiffs or enforcement agencies to challenge business activities successfully, will likely complicate antitrust compliance, compliance training, and risk management for companies engaged in interstate commerce.
Before engaging in activity aimed at resolving disputes over generic entry and brand patent protection, it is important to engage competent counsel to prevent any unnecessary cost and expense that may result from an unwitting violation of state law.
“Terms of Service.” Probably all of us have been asked at some point or another to agree to a company’s TOS in order to access its services. Most often, this happens when we download an app to our phone, though it can happen on a regular website as well. It’s not like we have much choice: if we want to use the app, we must agree to the TOS. If we don’t want to agree, we can’t use the app. In practice, that almost always means we agree to the TOS.
TOS commonly contain an arbitration clause. Depending on the clause, arbitration may be subject to—for example—restrictions on remedies, prohibitions against class actions, or limits on recoverable damages. And under typical arbitration rules, there will almost certainly be less and narrower discovery than in court. So it should come as no surprise that some lawyers and litigants cast about for ways to get around arbitration clauses, including in cases where the clause is in TOS.
Last month, in Davitashvili v. Grubhub, No. 23-521 (2d Cir. Mar. 13, 2025), the Second Circuit addressed almost every conceivable threshold question about whether a dispute is arbitrable. In that case, the court looked at three different companies’ TOS to assess (1) whether the parties had agreed to arbitrate at all; (2) if they had agreed to arbitrate, whether it was a court or arbitrators who should decide whether the dispute was within the arbitration clause; (3) if it was for the court to decide, whether the dispute was within the arbitration clause; and (4) if the dispute was covered by the clause, whether the clause was enforceable. In other words, this case presented pretty much every arbitrability-related threshold question imaginable.
Here are the facts. Grubhub, Postmates, and Uber all provide online platforms where customers can order meals from restaurants for pickup and delivery. The restaurants agreed with the platforms not to sell their meals at prices lower than they charge on the platform. That agreement was the basis for an antitrust class action. Three purported classes of restaurant customers sued: those who bought food for delivery or takeout at the restaurants but not on the platforms; those who dined in the restaurants; and those who bought from these restaurants on some other platform. The idea was that, because the platforms required the restaurants not to sell at prices lower than on the platforms, each of these classes had to pay higher prices for their meals than they would have otherwise. In other words, the class action alleged a form of price-fixing.
Note that these classes aren’t defined by reference to any of the platforms’ apps—obviously in order to get around the arbitration clauses in each app’s TOS. But some of the class members (maybe many, or even most) had actually downloaded one or more of the platforms’ apps and accepted their TOS. So does that mean they have to arbitrate their claims?
The first issue was whether there was an agreement to arbitrate at all. There was no issue when it came to Uber and Postmates—those platforms’ customers had agreed to arbitrate. For Grubhub it was less clear. The issue was whether the screen on Grubhub’s interface was designed so that users had inquiry notice of the TOS they were being asked to accept. Typically, for “click-wrap” agreements, in which users are asked to agree to TOS, the users are bound only if they had at least “inquiry” notice of the TOS. Whether there was inquiry notice turns, broadly speaking, on whether the interface makes clear to a user that the “agree” (or “confirm”) button links to the TOS, without excessive distraction on the page, and whether the TOS are reasonably accessible.
In this case the Second Circuit held that the Grubhub web interface was clean and clear enough to place a reasonably prudent user on inquiry notice—though Judge Pérez in her concurring opinion thought Grubhub made the cut just barely, commenting that if the “interface were even marginally more cluttered, the outcome of this appeal would likely be different.” So companies asking users to agree to their TOS would be well-advised to make sure that the screen presenting the TOS to users for agreement should be clean, uncluttered and clear.
Because Grubhub users were on inquiry notice there was an agreement to arbitrate. That led to the next issue: who should decide whether that agreement to arbitrate covers the price-fixing dispute—should it be a court or an arbitrator? This question turns on the language of the arbitration clause. Under Grubhub’s TOS, “issues related to the scope, validity, and enforceability of this Arbitration Agreement are for a court to decide.” So that was pretty clear. But the outcome was different for Uber and Postmates—the Second Circuit held that arbitrators rather than a court decide whether the arbitration clauses in their TOS cover the dispute.
The main remaining issue as to Grubhub was this: were the antitrust class action claims covered by the arbitration clause? The Second Circuit’s answer was no. The key issue was whether the language of the arbitration clause covered the antitrust class actions. Here is the relevant part of Grubhub’s TOS:
You and Grubhub agree that all claims, disputes, or disagreements that may arise out of the interpretation or performance of this Agreement or payments by or to Grubhub, or that in any way relate to your use of the Platform, the Materials, the Services, and/or other content on the Platform, your relationship with Grubhub, or any other dispute with Grubhub, (whether based in contract, tort, statute, fraud, misrepresentation, or any other legal theory) (each, a ‘Dispute’) shall be submitted exclusively to binding arbitration.
Recall the basis of the antitrust claims: the plaintiffs alleged that Grubhub essentially fixed prices by requiring restaurants that sold through Grubhub to agree not to charge lower prices elsewhere than they charge on Grubhub. Grubhub argued that the antitrust claims “relate to [the plaintiffs’] use of the Platform” because their use of Grubhub’s services helped give Grubhub the economic clout to engage in the claimed anticompetitive activity. But the Second Circuit viewed that as too speculative and tenuous a connection to the claims. In the court’s view, the antitrust claims arose from the plaintiffs’ use of other platforms or direct dealings with the restaurants, where they had to pay allegedly artificially high prices, and not from their use of Grubhub’s app. In fact, some class members had never even accessed the Grubhub app—which underscored the court’s point that it was just a coincidence that some members of the plaintiff classes had used Grubhub’s platform.[1]
The bottom line is that the antitrust class actions against Grubhub remained in court. But that is not the end of matters. There are two additional opinions: one concurrence and one partial dissent. They are worth noting because they may presage issues that might come up in the future.
First, Judge Pérez’s concurrence. Judge Pérez stressed that the under the Federal Arbitration Act (“FAA”), a court can compel arbitration only if the dispute arises out of the particular contract that contains the arbitration clause—in her words, if there is a “nexus” between the claim and the contract. In other words, it doesn’t matter how broadly drafted the clause may be; Judge Pérez would say that a court does not have power to direct the parties to arbitration if a particular dispute doesn’t clearly enough “aris[e] out of” the contract (in the words of the FAA). Depending on how narrowly a future court may view any proposed “nexus,” this approach may materially alter the scope of courts’ perceived authority to send disputes to arbitration.
Judge Sullivan dissented in part. He agreed there must be some kind of connection (or nexus) between the dispute and the contract containing the arbitration clause, so a dispute that is completely unrelated to the contract cannot be sent to arbitration. But his view of an adequate connection was different from the other judges on the panel. He thought the class action claims did arise from the apps. The plaintiffs’ theory of liability was that Grubhub through its app had amassed so much market power that restaurants had no choice but to agree to Grubhub’s “no price competition” terms. Thus, reasoned Judge Sullivan, if pervasive use of Grubhub is the basis for the antitrust claims, the claims “arise out of” use of Grubhub for purposes of compelling arbitration under the FAA.
Where does this leave us? It isn’t every day that we get three opinions from a three-person appellate panel. Is this case a harbinger of a possibly less broad policy in favor of arbitration at the federal level? Might it indicate ongoing ferment about how tight the connection has to be between claims and clause before a dispute can be referable to arbitration? It remains to be seen. Ultimately, of course, the final say on the matter will be with the Supreme Court.
The plaintiffs had also argued that it would be unconscionable to require their claims to be arbitrated, but the Second Circuit was unimpressed. The plaintiffs had not even sufficiently advanced the argument in their papers, and certainly not in enough detail to be considered properly. ↑
Over the past few years, companies have been hit by a wave of hundreds of putative class actions—and untold numbers of threatened mass arbitrations—alleging that use of pixel tracking tools violates the Video Privacy Protection Act (“VPPA”). In the first few months of 2025, that trend continued due to (among other things) the ever-growing use of pixels and similar technology and the Second Circuit’s recent decision in Salazar v. National Basketball Ass’n,[1] which gives an expansive reading to the statute. In fact, as of March 1, 2025, at least twenty-eight VPPA cases have already been filed. This trend parallels the filing rates in recent years, during which around two hundred cases were filed annually.
The Sixth Circuit, however, just rejected the Second Circuit’s reading in Salazar v. Paramount Global,[2] a highly similar case involving the same plaintiff. The second Salazar case (which we refer to as Paramount for clarity) creates a circuit split on who is a “consumer” of “goods and services” under the statute—which is notable because a petition for certiorari has already been filed seeking review of the Second Circuit’s decision.
In light of these recent and significant developments, companies with an online presence should be aware of the contours of the VPPA, trends in VPPA litigation, and various defenses and arguments available to them.
The VPPA
Congress enacted the VPPA in 1988 in response to a newspaper’s disclosure of VHS tapes that then–Supreme Court nominee Judge Robert Bork rented from a local video rental store. The statute forbids disclosing certain data about consumers’ video viewing habits, along with identifying information, without their consent.
Specifically, the VPPA prohibits “video tape service provider[s]” from “knowingly disclos[ing]” consumers’ “personally identifiable information” (“PII”) to third parties.[3] Under the Act, PII is “information which identifies a person as having requested or obtained specific video materials or services.”[4] The statute defines a “video tape service provider” as any entity “engaged in the business . . . of rental, sale, or delivery of prerecorded video cassette tapes or similar audio visual materials.”[5] Significantly, the VPPA contains a private right of action and authorizes recovery of “actual damages but not less than liquidated damages in an amount of $2,500” per violation, punitive damages, attorneys’ fees and costs, and other equitable relief.[6]
Pixel Litigation and the Salazar Decisions involving the NBA and Paramount
The recent influx of VPPA lawsuits and mass arbitrations can be attributed to the coalescence of two phenomena: (1) the ever-increasing use of pixel technology and (2) the growing number of courts, such as the Second Circuit in Salazar, giving key terms in the VPPA a broad reading. But time—and perhaps the U.S. Supreme Court—will tell whether the Sixth Circuit’s April 2025 decision in Paramount represents a turning of the tide in which courts begin to rein in VPPA claims.
A. The Prevalence of Pixels
VPPA lawsuits initially focused on companies’ use of Meta’s Pixel tool, a piece of code embedded in a website’s HTML. The code sends Meta information about what visitors do on the website, which enables the website operator to understand the effectiveness of its ad campaigns on Meta and other website user behaviors. What information it sends depends on how the website configures the Pixel. The use of Meta’s Pixel tool is widespread and spans a number of industries: according to a March 2024 report, about 47 percent of websites use Meta Pixel, including 55 percent of those in the S&P 500, 58 percent in the retail industry, 42 percent in finance, and 33 percent in health care.[7] Other social media companies, including X (formerly Twitter), now offer tracking pixels, too.[8]
Plaintiffs contend that VPPA liability can arise when a pixel is set up to share with a third party (1) information about a prerecorded video that a user watches on a company’s website (such as the title of the video); and (2) information that could be used to identify that user. This use of pixels has drawn plaintiffs’ lawyers like a moth to the flame, in large part because of the VPPA’s private right of action and potential for massive statutory damages if a class is certified.
B. The Salazar Decisions
The Second Circuit’s decision in Salazar has further accelerated this trend. Plaintiff Michael Salazar brought a lawsuit against an entity one wouldn’t naturally think of as a “video tape service provider”: the National Basketball Association.[9] Salazar had signed up for the NBA’s newsletter by providing the company his email address.[10] He then visited the NBA’s website and watched basketball videos.[11] Based on these unexceptional facts, Salazar alleged that the NBA violated the VPPA.[12] Why? Because the NBA’s website used the Meta Pixel, he alleged, some of his personal information—his Facebook ID and information about the videos he watched—was sent to Meta without his consent.[13]
Salazar’s complaint was initially dismissed.[14] The district court held that the VPPA required him to offer plausible allegations that (1) the NBA newsletter was a “good or service” within the meaning of the VPPA and that (2) he was a “consumer” of that good or service. He also needed to allege facts demonstrating that he has standing under Article III of the U.S. Constitution, which, among other things, requires that he allege suffering a “concrete” injury. The district court agreed that Salazar had standing to sue, but it dismissed the claim on the merits because it determined that Salazar was not a “consumer” within the meaning of the VPPA.
The Second Circuit reversed, holding that Salazar was a “consumer” under the statute.[15] The VPPA defines “consumer” to mean “any renter, purchaser, or subscriber of goods or services from a video tape service provider.”[16] The NBA asserted that the online newsletter Salazar signed up for was not a “good or service” within the meaning of the Act, because it was not an audiovisual good or service—a qualifier that the NBA argued was consistent with the statute’s requirement that the “goods or services” must come “from a video tape service provider.”[17] But the Second Circuit rejected this limitation of the statutory language, holding that any consumers—even those who receive non-audiovisual goods from the video tape service provider—are covered by the statute.[18] Plaintiffs are already relying on this aspect of Salazar in bringing lawsuits involving “goods and services” provided by a whole host of industries, ranging from education to sports betting.[19]
The Second Circuit also rejected the NBA’s challenge to Salazar’s standing. The NBA pointed out that any information about Salazar was not disclosed to the public but instead directed to one private company (Meta), and accordingly the nature of the disclosure was insufficient to count as the kind of “harm ‘traditionally recognized as providing a basis for lawsuits in American courts’”—the test under Supreme Court precedent for whether an alleged harm constitutes a “concrete injury” for Article III purposes.[20] The court of appeals rejected this argument, holding that Salazar had standing because his “alleged injury stems from the unauthorized disclosure of his personal viewing information, which is closely related to at least one common-law analog . . . [the] public disclosure of private facts.”[21] In holding that disclosure to one company alone is enough, the court found it significant that Meta is a major company that uses the information for advertising, and that (according to the complaint) did not have any restrictions on its selling, disclosing, or otherwise using the data.[22]
Despite describing its holding as “narrow,” the Second Circuit’s decision in Salazar has already had a significant impact in this area.[23] In the Ninth Circuit, where the court of appeals has not yet reached the issues presented in Salazar, a district court in the Southern District of California has already denied a motion to dismiss a claim by a plaintiff suing Zillow for its use of pixels, relying on Salazar’s reasoning.[24] In the Second Circuit, courts have quickly made rulings following Salazar’s lead.[25] In the Eighth and D.C. Circuits—where appeals concerning interpretation of the VPPA are pending—litigants have cited to Salazar in an effort to persuade those courts.[26]
On March 14, 2025, the NBA filed a petition for certiorari seeking Supreme Court review of the Second Circuit’s decision.[27] In its petition, the NBA argues that the Second Circuit’s decision created not one but two circuit splits. First, it asserts that the Second Circuit split from the Third, Seventh, Tenth, and Eleventh in holding that a consumer suffers concrete harm when one business discloses the consumer’s personal information to another, even if that information is never disclosed to the public. Second, it argues that the Second Circuit’s ruling on the VPPA definition of “consumer” creates a circuit split because the Sixth, Seventh, and D.C. Circuits are considering the same issue on appeal and are “likely to reject” the Second Circuit’s broad interpretation.[28]
The NBA’s prediction was correct as to the Sixth Circuit: on April 3, 2025, that court issued a ruling in Paramount (its own case involving Salazar), opting for a narrower reading of the statute. In that case, the same plaintiff sued Paramount Global under the VPPA, asserting that a website owned by the defendant disclosed his video viewing history and Facebook ID without his consent.[29] As in his case against the NBA, Salazar asserted that he was a “consumer” because he became a “subscriber” to the website when he signed up for its online newsletter.[30] A federal court in Tennessee disagreed, holding that the definition of “subscriber” is “cabined by the definition of ‘video tape service provider.’”[31] Thus, the district court concluded, “to qualify as a ‘consumer,’ a ‘plaintiff must be a subscriber of goods and services in the nature of audio-video content.”[32] Salazar’s allegations failed, the court explained, because Salazar did not plausibly allege that a newsletter subscription “was a condition to accessing the site’s videos, or that it enhanced or in any way affected [his] viewing experience.”[33]
The Sixth Circuit affirmed, holding that “the most natural reading” of the statute limits the definition of “consumer” to apply only to someone who “subscribes to ‘goods or services’ in the nature of ‘video cassette tapes or similar audio visual materials.’”[34] The court’s holding pointed to a line of Supreme Court decisions emphasizing that particular words in a statute must be interpreted in the context of the statute as a whole.[35]
It remains to be seen whether the Sixth Circuit’s decision in Paramount will stanch the flow of VPPA complaints, at least outside the Second Circuit. In the immediate term, Paramount—which acknowledges creating a circuit split on the question of how to define the term “consumer” under the statute—increases the likelihood that the Supreme Court will grant the NBA’s petition and take up the issue itself.
Defenses and Arguments
In light of these developments and the continued flood of VPPA lawsuits, companies should be aware of potential arguments and defenses. We discuss some of these defenses and arguments below.
A. Procedural Defenses
i. Moving to Compel Arbitration
As a threshold matter, in many instances, defendants will have strong grounds to compel arbitration if their customer terms of service include an arbitration provision. That is because the VPPA’s definition of “consumer” is limited to a “renter, purchaser, or subscriber of” a defendant’s services,[36] and many companies require website visitors to assent to an arbitration provision prior to subscribing or making a purchase.
But companies that have strong arbitration arguments to avoid class action lawsuits in court may nonetheless be targeted by mass arbitrations. Several plaintiffs’ firms specialize in threatening mass arbitrations independent of or as follow-ons to privacy class actions, and VPPA cases are no exception to this trend. Indeed, there are several websites actively recruiting claimants to assert VPPA claims in mass arbitrations. Accordingly, potential VPPA defendants should also take steps to ensure that their arbitration agreements contain provisions to ameliorate the possibility of mass arbitration.[37] One point to consider; the 2024 AAA rules regarding mass arbitrations alleviate some of the burdens on defendant companies by introducing a “process arbitrator” to manage administrative issues in some circumstances and implementing a fee structure for better predictability and reduced initial burdens on all parties.[38]
ii. Challenging Class Certification
Even if a VPPA claim is not dismissed at the pleading stage, defendants should have arguments to raise in opposing class certification. For example, defendants can oppose certification of classes under Rule 23(b)(3)’s predominance prong. Because website users configure their browsers differently—some don’t accept cookies, others install software designed to block data sharing, and others still aren’t logged into their Facebook account on the same browser from which they access a defendant’s website—the data disclosed to Meta will not be uniform across visitors. As a result, defendants could argue that the individualized inquiry that would be required to determine whether a class member’s PII was actually disclosed would overwhelm any common issues. In addition, to the extent class litigation waivers are permissible in a particular jurisdiction, defendants should raise that issue. The Salazar court mentioned the NBA’s class-litigation waiver argument in a footnote but did not reach it on its merits.[39]
B. Statutory Arguments
i. Safe Harbor for Consent
The VPPA contains a safe harbor that permits companies to disclose consumers’ PII as long as they first obtain consent in the manner prescribed by the statute.[40] The VPPA also authorizes disclosure of PII to third parties if it “is incident to” the company’s “ordinary course of business”—a term defined to “mean[] only debt collection activities, order fulfillment, request processing, and the transfer of ownership.”[41]
Some VPPA defendants may have a viable consent-based defense, depending on their privacy and cookie policies or other terms of service. To be effective under the VPPA, “informed, written consent” must meet certain statutory requirements: It must (1) be “in a form distinct and separate from any form setting forth other legal or financial obligations of the consumer,” (2) be given at the time disclosure is sought or given in advance for a set period of time not to exceed two years, and (3) provide the consumer with the ability to opt out from disclosures “in a clear and conspicuous manner.”[42] Courts have suggested that, because of these requirements, the disclosure cannot be part of a website’s general privacy policy or terms of service and must instead consist of its own page or pop-up notice.[43] The Salazar court reserved the question of whether Salazar had consented to disclosure of his PII by assenting to the NBA’s privacy policy, which stated that it collects certain “Personal Information” from site visitors.[44] But defendants are more likely to be able to invoke consent if the presentation and wording of the consent language is clear to the reasonable user.[45]
ii. Interpretive Arguments
Personally Identifiable Information
Generally speaking, plaintiffs in Pixel-related VPPA actions allege that the information that a website sends to Meta (or other Pixel provider) typically includes some combination of (1) the user’s unique Facebook ID, (2) the name of the video the user watched, (3) the times when the user started and stopped viewing the video, and (4) the video’s URL. Plaintiffs then argue that this information constitutes PII under VPPA, because it is “information which identifies a person as having requested or obtained specific video materials.”[46]
Circuit courts (including the Second Circuit) have not addressed whether the above information would constitute PII.[47] Instead, what exists is a patchwork of cases attempting to interpret what could constitute PII on a case-by-case basis. The First Circuit, for example, decided that a plaintiff’s GPS coordinates at the time he viewed a video was PII, because another “unrelated third party” was able to “[u]s[e] this information . . . to identify [the plaintiff] and link the videos he had viewed to his individualized profile maintained by [the third party].”[48] By contrast, the Ninth Circuit determined that a plaintiff’s Roku device serial number and the names of the videos he watched were not PII, because “that information cannot identify an individual unless it is combined with other data in [a third party’s] possession.”[49] The Third Circuit recognized the complexity of discerning what PII means, noting that its interpretation “has not resulted in a single-sentence holding capable of mechanistically deciding future cases.” As it stated, “We have not endeavored to craft such a rule, nor do we think, given the rapid pace of technological change in our digital era, such a rule would even be advisable.”[50]
In light of the complexities inherent in the term “personally identifiable information,” companies should consider whether the data collected by the pixel on their website is PII. To the extent defendants operate a version of Meta Pixel that only sends some, but not all, of the information listed above, they should consider contesting whether it is PII, as some courts have dismissed VPPA claims on this ground.[51]
Subscriber
As mentioned above, the VPPA applies only if the plaintiff is a “renter, purchaser, or subscriber.”[52] The Salazar court and the First Circuit have interpreted the term “subscriber” broadly to encompass those who have provided any personal information to a company in exchange for a good or service.[53]
Other circuits have been skeptical of adopting this broad definition. The Eleventh Circuit, for example, has twice declined to confer “subscriber” status to a plaintiff under the VPPA.[54] That court has held that merely downloading a free application is insufficient to confer “subscriber” status and held that a subscription “involves some type of commitment, relationship, or association (financial or otherwise) between a person and an entity.”[55]
Goods and Services and “Video Tape Service Provider”
Most courts have interpreted the term “similar audio visual materials” fairly broadly to include essentially all prerecorded video content on a website, even if such content does not bear a close resemblance to the feature-length films that inspired Congress to pass the VPPA. However, several courts have concluded that live-streamed video content is not covered by the statute, because it is not “prerecorded,” and a couple of defendants have achieved dismissal of VPPA claims on that basis.[56] Similarly, the U.S. District Court for the Northern District of Illinois recently confirmed that a video-editing application is not a “video tape service provider” under the statute because it provides users the ability to edit their own videos—even if that service provides filters, templates, visual effects, or other tools.[57] Relatedly, the Ninth Circuit recently held that movie theaters are not “video tape service providers” within the meaning of the statute because the “provision of shared access to film screenings” is not encompassed by the statute’s definition limiting video tape service providers to those engaged in the “rental, sale, or delivery” of prerecorded videos.[58]
C. Constitutional Defenses
i. Standing
First, VPPA claims may be vulnerable on standing grounds. Because such claims are generally based purely on a statutory violation, there are good arguments that they fail the “concrete injury” standard set forth in TransUnion LLC v. Ramirez. That said, standing challenges in Pixel VPPA cases have failed to gain much traction, as several courts have concluded that, at their core, VPPA claims are premised on the disclosure of private information, a type of harm that these courts deem sufficient to confer standing.[59] The Ninth Circuit has joined the Eleventh and Third Circuits in holding, prior to TransUnion, that alleged violations of the VPPA are sufficient in themselves to satisfy the concrete-injury requirement.[60] But an appeal currently pending in the Ninth Circuit is worth watching to get that court’s latest word on how to approach standing in privacy cases in light of TransUnion.[61]
ii. First Amendment
Next, defendants could mount a viable First Amendment challenge to the VPPA on grounds that the statute impermissibly restricts and chills protected noncommercial speech. Patreon asserted such a challenge to the VPPA.[62] Though the court ultimately found that the merits of the challenge were too fact-intensive to be decided at the pleading stage, it appeared receptive to some of Patreon’s arguments (including that the VPPA’s regulations are content-based) and urged Patreon to reassert its challenge on a more developed record. (Patreon ultimately settled its case.[63]) Other district courts have reached similar conclusions on the First Amendment question.[64]
iii. Due Process
Finally, because the VPPA authorizes $2,500 in statutory damages per violation, a defendant could contend that an aggregated award would be excessive and thus violate due process. Though this argument might not be viable until the class certification stage, it has recently proven successful in similar statutory contexts. In one case, the Ninth Circuit vacated a statutory damages award of over $900 million in a Telephone Consumer Protection Act (“TCPA”) case on grounds that the district court failed to properly consider the due process implications of such an award.[65] The Eighth Circuit similarly affirmed a district court’s decision to reduce a $1.6 billion TCPA verdict to $32 million, because the original award was “so severe and oppressive as to be wholly disproportioned to the offense and obviously unreasonable.”[66] And, while the Seventh Circuit ultimately affirmed a $280 million verdict in a TCPA case, it noted that the district court had charged the defendant only about $4 per violation and that imposing the statutory maximum of $10,000 per violation “would be impossible to justify.”[67]
Conclusion
The trends make clear that companies that offer videos on their websites will continue to face VPPA lawsuits, and courts will need to grapple with the text of a statute written when the corner video rental store was ubiquitous. Few of these cases have proceeded far—and no federal VPPA class action has gone to trial yet. What we can confidently predict is that VPPA litigation will continue to evolve as a greater body of case law emerges over the next several years, and businesses should remain attuned to developments in the law.
See, e.g., Calhoun v. Google, LLC, 113 F.4th 1141, 1151 (9th Cir. 2024) (“[A] determination of what a ‘reasonable’ user would have understood must take into account the level of sophistication attributable to the general public, which uses Google’s services.”). ↑
Some district courts have generally concluded that, because disclosure of the Pixel allegedly shares both the user’s unique Facebook ID—which can be used to ascertain the user’s Facebook profile—and the name of the video watched, an ordinary person could use that information to glean a specific individual’s video-watching behavior. See, e.g., Stark v. Patreon, Inc., 635 F. Supp. 3d 841, 853 (N.D. Cal. 2022); Feldman v. Star Trib. Media Co., 659 F. Supp. 3d 1006, 1014–15, (D. Minn. 2023); Czarnionka v. Epoch Times Ass’n, Inc., No. 22 Civ 6348 (AKH), 2022 WL 17069810, at *4 (S.D.N.Y. Nov. 17, 2022). ↑
See, e.g., Martin v. Meredith Corp., 657 F. Supp. 3d 277 (S.D.N.Y. 2023), appeal withdrawn, No. 23-412, 2023 WL 4013900 (2d Cir. May 24, 2023) (dismissing VPPA claims when the defendant ran a version of the Meta Pixel that sent only the user’s Facebook ID and the name of the webpage accessed); see also, e.g., Ghanaat v. Numerade Labs, Inc., 689 F. Supp. 3d 714, 721 (N.D. Cal. 2023). ↑
Yershov, 820 F.3d at 487; see also, e.g., Harris v. Pub. Broad. Serv., 662 F. Supp. 3d 1327, 1334–35 (N.D. Ga. 2023); Lebakken v. WebMD, LLC, 640 F. Supp. 3d 1335, 1339–40 (N.D. Ga. 2022) (concluding that plaintiffs are plausibly covered as “subscriber[s]” as long as they register for an account and provide personal information in the process). ↑
Ellis v. Cartoon Network, Inc., 803 F.3d 1251, 1254, 1256 (11th Cir. 2015); see also Perry, 854 F.3d at 1342–43. ↑
See, e.g., Stark v. Patreon, Inc., 635 F. Supp. 3d 841, 853–54 (N.D. Cal. 2022); Louth v. NFL Enters. LLC, 2022 WL 4130866, at *4 (D.R.I. Sept. 12, 2022). ↑
See, e.g., Martin v. Meredith Corp., 657 F. Supp. 3d 277 (S.D.N.Y. 2023); Feldman v. Star Trib. Media Co., 659 F. Supp. 3d 1006, 1015 (D. Minn. 2023). ↑
Eichenberger v. ESPN, Inc., 876 F.3d 979, 984 (9th Cir. 2017) (citing Perry, 854 F.3d at 1341; In re Nickelodeon Consumer Priv. Litig., 827 F.3d 262, 274 (3d. Cir. 2016)). ↑
See, e.g., Saunders v. Hearst Television, Inc., 711 F. Supp. 3d 24, 32–33 (D. Mass. 2024); Christopherson v. Cinema Ent. Corp., No. 23-cv-3614, 2024 U.S. Dist. LEXIS 47847, at *13 (D. Minn. Mar. 6, 2024). ↑
However, the panel also noted that reducing statutory damages awards should not be done lightly and “must be reserved for circumstances” in which the award is “gravely disproportionate to and unreasonably related to the legal violation committed.” Wakefield v. ViSalus, Inc., 51 F.4th 1109, 1124 (9th Cir. 2022), cert. denied, 143 S. Ct. 1756 (2023); see also Montera v. Premier Nutrition Corp., 111 F.4th 1018, 1043 (9th Cir. 2024) (Ninth Circuit remands district court decision to determine whether the statutory damages award violates due process under Wakefield.). ↑
Golan v. FreeEats.com, Inc., 930 F.3d 950, 963 (8th Cir. 2019) (quoting St. Louis, I.M. & S. Ry. Co. v. Williams, 251 U.S. 63, 67 (1919)). ↑
This article discusses a Showcase CLE program titled “All the President’s Men: A Look at Attorneys’ Ethical Duties in View of Recent Disbarments and Criminal Convictions” that took place at the American Bar Association Business Law Section’s 2025 Spring Meeting. All Showcase CLE programs were recorded live and will be available for on-demand credit, free for Business Law Section members.
The legal profession has long upheld a duty to maintain ethical integrity, ensuring that attorneys act within the boundaries of professional responsibility while zealously representing their clients. Yet, recent years have tested the limits of these ethical standards, particularly in the political and corporate arenas. High-profile cases involving attorneys working in presidential administrations and as in-house counsel for entities and educational institutions—as well as the legal profession at large—have resulted in an unprecedented wave of disciplinary actions, disbarments, and even criminal convictions. These cases provide striking examples of what may happen when attorneys prioritize personal loyalty, political influence, or financial gain over their fundamental ethical obligations or, in some cases, failures to properly identify their client.
This presentation will examine the evolving landscape of legal ethics through the lens of recent attorney misconduct cases, exploring how and why these ethical lapses occurred, what lessons can be drawn from them, and how attorneys can ensure they remain within the bounds of professional conduct. The discussion will emphasize the core duties that attorneys owe to their clients, the judicial system, and the public, as well as how ethical boundaries shape legal advocacy, decision-making, and professional accountability.
At the heart of this discussion are the ABA’s Model Rules of Professional Conduct, which serve as the foundation for ethical legal practice. The presentation will analyze critical provisions such as Rule 1.2 (Scope of Representation and Allocation of Authority Between Client and Lawyer); Rule 1.13 (Organization as Client); Rule 1.16 (Declining or Terminating Representation); Rule 1.6 (Confidentiality of Information); Rule 3.3 (Candor Toward the Tribunal); Rule 5.1 (Responsibilities of Partners, Managers, and Supervisory Lawyers); and Rule 8.4 (Misconduct). Through case studies of attorneys who have faced disciplinary actions or criminal prosecution, the panel will illustrate how these ethical guidelines were violated and the consequences that followed. It will also address the recent ABA Formal Ethics Opinion 513 (Aug. 23, 2024) regarding an attorney’s “duty to inquire into and assess the facts and circumstances of each representation” and possibly the obligation to withdraw from such representation under the now amended ABA Model Rule 1.16, as well as ABA Formal Opinion 514 (Jan. 8, 2025) regarding an attorney’s “obligations when advising an organization about conduct that may create legal risks for the organization’s constituents.”
One of the key themes of this discussion is the tension between zealous advocacy and other ethical responsibilities. Attorneys have a duty to vigorously represent their clients within the bounds of the law, but where do the boundaries lie, and when do attorneys cross them? Recent cases involving election-related litigation, obstruction of justice, and business fraud have underscored the difficulty attorneys face when they navigate high-stakes political and corporate environments. Lawyers who crossed ethical lines—whether by submitting false claims, misleading courts, suppressing evidence, or engaging in other forms of misconduct—have faced disbarment, financial penalties, and, in some cases, imprisonment.
Beyond the direct consequences for individual attorneys, these high-profile cases have significant implications for the broader legal profession. Public confidence in the legal system is heavily influenced by attorneys’ conduct, particularly when attorneys are involved in matters of national significance. When attorneys violate ethical rules, they not only damage their own reputations but also erode trust in the integrity of the legal profession as a whole. This session will explore the public perception of attorney misconduct and discuss whether existing professional rules and enforcement mechanisms are adequate to deter unethical behavior.
Another crucial aspect of the discussion is the role of attorneys as gatekeepers of the justice system. Lawyers are not mere advocates for their clients; they are also officers of the court with a duty to uphold the rule of law. This responsibility requires attorneys to balance their obligations to clients with broader ethical duties to the legal system and the public. The presentation will address how attorneys can identify ethical red flags, navigate challenging situations, and seek ethical guidance before engaging in conduct that could lead to professional or legal consequences.
Additionally, the discussion will explore corporate legal ethics and business law applications, focusing on attorneys working in advisory roles within corporate entities. Attorneys serving in executive or in-house counsel positions may face immense pressure from corporate leadership to take legally questionable actions. The Enron scandal, the mortgage meltdown of the late 2000s, and more recent corporate legal battles highlight the risks attorneys face when they fail to exercise independent legal judgment. These examples will be used to illustrate the dangers of enabling unethical or illegal corporate behavior and the importance of attorneys maintaining professional independence.
This presentation offers a critical examination of the ethical challenges attorneys face in today’s legal and political climate. By analyzing recent cases of attorney misconduct, panelists will provide insights into the risks and responsibilities of legal practice. Through an exploration of professional conduct rules, real-world case studies, and ethical best practices, attendees will gain a clearer understanding of their obligations as attorneys and the importance of maintaining ethical integrity in all aspects of their work. The lessons drawn from these cases serve as a powerful reminder of the legal profession’s role in safeguarding justice and the rule of law.
This is the fourth installment in the Year in Governance Series from the In-House Subcommittee of the ABA Business Law Section’s Corporate Governance Committee. Each month, the series will share key tips on a different corporate governance topic. To get involved in the Corporate Governance Committee, please visit the committee’s webpage.
A message from Kathy Jaffari: “As Chair of the Corporate Governance Committee, I would like to extend my sincere appreciation to the authors for this publication. The Corporate Governance Committee has ongoing opportunities for writing and volunteering with various projects, whether it’s an article you want to publish or a CLE that you want to present. Our Committee is dedicated to helping you promote informative resources for corporate governance practitioners. You may contact me at [email protected] to get involved.”
There is an expanding array of technology platforms that facilitate board-related communications and administration of board functions, including some that leverage artificial intelligence (“AI”). Some companies are adopting new technologies, while others are staying with methods that have existed for many years. Regular reviews of the technology used for board-related functions will ensure that companies are weighing the benefits and drawbacks of their current approach while appropriately identifying innovative solutions that could provide enhanced efficiency and flexibility, or reduce risk.
Board Management and Communication Platforms: Numerous vendors offer platforms that provide an efficient medium for distribution of board materials, communications, and administration of board functions. Many of these platforms incorporate cybersecurity protections, thus reducing risk, and integrate with internal company systems such as those used for cloud storage and virtual collaboration. They can also help reduce risk by aiding with the administration of company record retention policies. Appropriate training should be provided to ensure consistency in adoption across the board and company stakeholders.
Audio and Video Recording: Recording board or committee meetings in audio or video format could present significant litigation risk. It is also inconsistent with the core governance principle that the minutes stand as the only record of such meetings. Even if deleted, recordings may later be recovered via backups. When using collaboration platforms for virtual board or committee meetings, deactivate the recording functionality.
Use of AI by Boards: For companies that are considering implementing AI solutions to record and summarize board and committee meetings, see the above tip on Audio and Video Recording. Separately, AI platforms may be able to summarize large amounts of written data, such as board books, which directors and others might find helpful. If considering such a technology solution, ensure that any third-party vendor leveraging AI will treat company information confidentially, has best-in-class cybersecurity controls, regularly tests its models for accuracy, and will not use the company’s data for its own business purposes.
Email Communications: Companies should use a secure board management and communication platform/portal for company-related communications. The use of personal email accounts for company business poses heightened cybersecurity concerns and can potentially jeopardize confidentiality. Use of personal or day-job email accounts could also expose those accounts to discovery in litigation. Companies should consider providing directors with company email accounts, on the company’s system and protected by its cybersecurity controls, for purposes of communicating on company business. If it is not possible to avoid directors’ using their everyday email accounts, they should avoid substantive messages and only exchange short, actionable messages like “Call me” or “Check the board portal for new material.”
Text Messaging: Companies should caution directors to avoid exchanging substantive text messages regarding company business using personal cell phones or devices. Like use of personal email accounts, use of text messaging via personal devices can give rise to security risks. Text messaging is also often informal, which can lead to the exchange of damaging, embarrassing, or unclear communications that could later become discoverable and misconstrued. If it is impossible to eliminate all text messaging, companies should advise directors that texts related to the company should only be sent for scheduling or administrative reasons (e.g., “I am running 10 minutes late”).
Business Continuity and Disaster Recovery: Boards, like companies, should confirm that their business continuity and disaster recovery plans are up to date, tested regularly, and stored in a place where they would be accessible in the event of a significant technology disruption caused by a cybersecurity or ransomware event or a weather disaster. As part of this planning process, boards should confirm that any company technology systems required for the board to communicate or access important information are appropriately backed up and prioritized from a systems resiliency standpoint so that they would be accessible in the event of a significant disruption.
Access to Records: Companies should regularly review their access controls, including who has access to electronic board and committee materials and communications. Access should only be granted to those with a “need to know.” Certain employees might only have a “need to know” as it relates to certain committees or matters, and access should be limited accordingly.
Destruction of Records: Failure to promptly destroy documents and communications in accordance with the company’s records retention policy, including those relating to the board, raises a company’s risk profile. Documents that could have been properly destroyed can become discoverable in litigation. Overbroad litigation hold orders can also result in companies retaining documents that they could and should have destroyed pursuant to their retention policies. If a company uses a board communications portal, it is advisable to confirm that the portal’s storage settings align with the company’s record retention policy.
Technology While Traveling: To address confidentiality and cybersecurity risks, precautions should be taken if the board meets outside of the United States, if directors reside or regularly travel abroad, and if board meetings occur at offsite locations. Companies should consider whether travel or meeting locations abroad present heightened risk of intrusion by state and nonstate actors. They should consider issuing directors with “vanilla” devices for company-related communications (including only software necessary for company business) and/or Faraday bags, which can potentially block signals and provide enhanced security. For offsite board meetings, companies should consider conducting digital sweeps for recording devices.
Website Bios and Social Media: Companies, in consideration of their respective risk profiles, should consider whether there is a need to include board (and management) biographies and photographs on company websites and social media sites given that this information could be exploited by bad actors seeking to do harm. It is a good practice to conduct a digital risk assessment periodically to identify what digital information on directors is publicly available so that guidance can be provided to minimize risk.
The views expressed in this article are solely those of the authors and not their respective employers, firms, or clients.
This article is Part VIII of the Musings on Contracts series by Glenn D. West, which explores the unique contract law issues the author has been contemplating, some focused on the specifics of M&A practice, and some just random.
Contractual boilerplate is much maligned. Every contract has it, but it is considered the “standard stuff” at the back that is rarely relevant to the “substantive” provisions at the front. The problem with that view is that a boilerplate provision contained in a contract between sophisticated parties is not, generally, any less enforceable than any other provision.[1] And the boilerplate provisions given short shrift in the negotiation or drafting of a contract could undermine other provisions of that contract.
Unconsidered or outdated boilerplate may contain landmines that could wreak havoc on your contract’s other “substantive” provisions. But these landmines exist primarily because of thinking about boilerplate as if it were somehow not a substantive part of the contract. The fact “is that ‘boilerplate’ is a misnomer as applied to these provisions and that lying in wait within each of them are significant business and legal issues.”[2] Just because “these provisions . . . have been in the firm’s precedents for ages, garnering ever more hallowed status,” does not mean that they are exempt from the same “critical analysis” that has been brought to bear on what are perceived to be the more substantive parts of the contract.[3] Indeed, these provisions may have been “drafted by geniuses, but those geniuses may have been wearing powdered wigs.”[4]
While contractual boilerplate is routinely relegated to the “Miscellaneous” section at the very back of a contract, the subjects covered include matters that could be outcome-determinative if there is a subsequent dispute regarding other contract terms. Those subjects include, among others: what law will govern any dispute (and whether that chosen law includes the chosen law’s statute of limitations and applicable tort law),[5] in what forum any dispute must be adjudicated (and whether those claims requiring adjudication will include related tort claims or just the contractual ones),[6] whether third parties have any enforceable rights under the contract,[7] whether the contract is assignable,[8] how certain words and phrases are to be interpreted, whether actions by a party may constitute a waiver of its substantive rights under the contract, and how and where notices are to be delivered. In reviewing contractual boilerplate after a dispute arises, one can be either mining for gold or uncovering landmines depending on the extent of the contractual hygiene[9] practiced when the contract was first negotiated. In other words, one could find either peril or delight in a subsequent review of these provisions once a dispute arises.
The Peril Side of Contractual Boilerplate
The typical survival provision provides that the right to indemnification terminates with respect to any indemnifiable claim for which the indemnifying party has not received notice before the end of the specified survival period.[10] While there are frequent disputes over whether the notice of claim was valid when the claim was for losses not yet incurred or the notice failed to provide sufficient detail of the claim,[11] it is rare that there is a dispute over whether the notice was timely. Just ensure the indemnifying party receives your notice before the end of the survival period. Right?
In a recent Delaware Superior Court decision, Mosaic Capital Partners v. Local Bounti Operating Co.,[12] Judge Paul R. Wallace had to consider whether a notice received by the indemnifying party after “normal business hours” on the last day of the specified survival period was timely and preserved the indemnification claim. The survival provision was set forth in Article VIII of the Purchase Agreement. Section 8.01(a) provided that:
Except as set forth below in this Section 8.01, the representations and warranties of the Sellers, the Target, Parent and Purchaser contained in this Agreement or in any certificates or documents delivered hereunder shall survive for a period of time ending at 11:59 p.m. Eastern Time, on that date which is twelve (12) months after the Closing Date.[13]
Section 8.05(a) of the Purchase Agreement further provided that:
No Seller Indemnifying Party shall be liable for any claim for indemnification under this Article VIII unless written notice of a claim for indemnification is delivered by the Purchaser Indemnified Party seeking indemnification to the Seller Indemnifying Party from whom indemnification is sought prior to the expiration of any applicable survival period set forth in Section 8.01 (in which event the claim shall survive until finally and fully resolved).[14]
The buyer sent a claim notice to the seller by email “at 10:04 p.m. EST” on April 4, 2023 (the twelve-month anniversary of the Closing Date). But the seller claimed that the notice was untimely (having been received by the seller on April 5, not April 4). Why? Well, buried in the boilerplate at the end of the Purchase Agreement was a notice provision, Section 11.03. That Section read as follows:
Notices. All notices, requests, consents, claims, demands, waivers and other communications hereunder shall be in writing and shall be deemed to have been given: (a) when delivered by hand (with written confirmation of receipt); (b) when received by the addressee if sent by a nationally recognized overnight courier (receipt requested); (c) on the date sentby facsimile or e-mail of a PDF document (with confirmation of transmission) if sent during normal business hours of the recipient, and on the next Business Day if sent after normal business hours of the recipient; or (d) on the third day after the date mailed, by certified or registered mail, return receipt requested, postage prepaid. Such communications must be sent to the respective parties at the following addresses (or at such other address for a party as shall be specified in a notice given in accordance with this Section 11.03).[15]
Because the survival period did not end until 11:59 p.m. EST on April 4, 2023, the buyer argued that applying the “normal business hours” requirement (particularly if that meant 9 a.m. to 5 p.m. as it has been historically understood) would effectively mean that the survival period was shortened by almost seven hours.
Because this was a Motion for Judgment on the Pleadings by the seller, the seller was required to demonstrate that its interpretation of the Purchase Agreement was “the only reasonable one because the agreement is unambiguous.”[16] Judge Wallace, however, determined that the Purchase Agreement (with the potential conflict between the survival clause and the boilerplate notice provision) was ambiguous. While “[s]pecific language in a contract controls over general language, and where specific and general provisions conflict, the specific provision ordinarily qualifies the meaning of the general one,”[17] Judge Wallace did not believe that he could determine whether Section 8.01 (a) or Section 11.03 was the specific provision governing the required notice of indemnification before the end of the survival period. After all, while the survival clause was explicit in tying the end of the survival period to 11:59 PM EST on April 4, 2023, unless written notice of an indemnification claim was received by the sellers prior to such time, the survival clause did not specify how any such notice was to be given; only the notice clause provided that specificity.
But there was another reason that Judge Wallace was hesitant to rule on the case without further evidence: he was not certain that giving timely notice in the manner prescribed by Section 11.03 was even a condition to the continued survival of the indemnity provision. Why? Because he viewed Section 11.03 as simply a “procedural” notice requirement and “the Court shouldn’t read any agreement in a way that permits a procedural provision to limit a substantive right, unless such . . . intention to do so is explicitly stated in the agreement.”[18] In other words, failure to give notice before 11:59 PM EST on April 4, 2023, may well have limited a substantive right because Section 8.05(a) said as much, but failure to give that notice until after the end of “normal business hours” may not have done so because Section 11.03 did “not clearly state it applies to indemnity notices.”[19]
Judge Wallace found potential support for viewing the requirements of Section 11.03 as simply “procedural” and not limiting the substantive rights in Article VIII by looking at yet another boilerplate provision—Section 11.10.[20] Section 11.10 of the Purchase Agreement, titled “Amendment and Modification; Waiver,” contained the following language: “No failure to exercise, or delay in exercising, any right, remedy, power or privilege arising from this Agreement shall operate or be construed as a waiver thereof.”[21]So, did it matter whether the notice was timely, at least pursuant to the required notice procedures in Section 11.03? Hmm.
Finally, to the extent compliance with notice during “normal business hours” pursuant to Section 11.03 was operative as a condition to the seller’s indemnification obligations under Article VIII, Judge Wallace also noted that he needed evidence of what exactly were “normal business hours” of the seller/recipient of the notice, Mosaic Capital Partners, a lower-middle-market private equity firm. Are their “normal business hours” really 9 a.m. to 5 p.m.? What are most private equity firms’ “normal business hours?”
Interestingly, although not cited by Judge Wallace in Mosaic, a similar issue arose in Fesnak and Associates, LLP v. U.S. Bank National Ass’n.[22] There, the U.S. District Court for the District of Delaware reacted the same way Judge Wallace did to a seeming conflict between a survival clause ending at 11:59 PM EST on June 9, 2010, a notice provision requiring notice by fax to be given during “normal business hours,” and a fax indemnity notice that was sent at 10:21 PM EST on June 9, 2010—the court decided it needed more evidence before ruling.
Is a reference to “normal business hours” something that should even be in a notice provision today, particularly given that the most likely notice it would apply to post-closing was the indemnification claim notice? Is a reference to “normal business hours” old-school and no longer workable? Obviously, this simple strike-through in the boilerplate notice provision would have presumably eliminated this dispute: “if sent during normal business hours of the recipient, and on the next Business Day if sent after normal business hours of the recipient.” And, by the way, did we ever think the standard no waiver clause (particularly the “no delay” language) would apply to a potential failure to provide timely notice of indemnification? Should we consider modifying or eliminating that language in M&A deals? Read on.
The Delight Side of Contractual Boilerplate
I have told a version of this story before,[23] but it’s the best illustration I know of the “outcome-determinative” delights that can be found in contractual boilerplate. There was once a public company that, as part of the audit of its financial statements, was informed that its accounting firm might need to issue a “going concern” qualification based upon the accounting firm’s review of the company’s public debt indenture. Apparently, the company had engaged in a transaction during the prior year that appeared to have violated one of the indenture’s negative covenants, and the accounting firm was seeking confirmation from the company’s counsel that the indenture had not been violated. The company’s counsel, however, was unable to provide that assurance.
Given the seriousness of the issue and the fact that a private equity firm controlled the company, we were called for a second opinion. Reviewing the negative covenant, it was clear that the transaction would likely have violated the otherwise broad prohibition without an applicable exception. However, an exception permitted transactions otherwise prohibited by the negative covenant to the extent permitted by the “Credit Agreement.” “Credit Agreement” was defined elsewhere in the indenture to be that certain Credit Agreement, dated as of a specific date, and entered into with a named bank, “as the same may be amended, modified, or replaced from time to time.”
While nothing in the original credit agreement would have permitted the transaction in question, it turned out that the original credit agreement had been amended to allow the transaction during the prior year. Someone at the company had been alerted to the need to amend the original credit agreement but hadn’t necessarily considered the impact on the indenture. It appeared clear, therefore, that the transaction was permitted under the indenture because it allowed any transaction permitted by the “Credit Agreement,” which was defined to include any amendments thereto. Somehow, the current company counsel overlooked this fact. However, we had an advantage because, in the early days of private equity, we insisted on these “as amended” definitions to provide flexibility for our private equity clients and their portfolio companies in agreements that were more difficult to amend (like an indenture). So we were alert to look for them.
While the “amended, modified or replaced from time to time” language may not have technically been boilerplate in this particular indenture (and instead was part of an operative definition), there are, in fact, many contracts, including purchase and sale agreements, that routinely include boilerplate provisions with a similar effect. Indeed, the Purchase Agreement at issue in Mosaic contained the following provision in Section 11.04:
Unless the context otherwise requires, references herein: . . . (y) to an agreement, instrument or other document means such agreement, instrument or other document as amended, supplemented and modified from time to time to the extent permitted by the provisions thereof.[24]
In a different dispute, this might be a delightful find or one contributing to peril. And again, it’s a fairly standard provision.[25] Is the flexibility it provides going to help or hurt? You have to decide whether you want to include it or not. One thing is for sure: you cannot ignore it simply because it’s considered “boilerplate.”
Could this “boilerplate provision” allow the seller to argue that a disclosed contract, which had been amended before entering into the Purchase and Sale Agreement but which amendment had been overlooked in compiling the disclosure schedules, had been disclosed in its “as amended” state? Presumably, any ability to rely on this clause to allow the seller to enter into amendments post-signing and pre-closing and have them deemed disclosed as of signing would be precluded by the pre-closing covenants. But, from a buyer’s perspective, what potential benefit could be derived from having this as part of the boilerplate? And what legitimate argument does the seller have to include this clause? While the clause may be helpful in other contexts, is it something better left out or at least modified to be clear it would not allow a nondisclosed amendment to have been deemed disclosed?
Concluding Thoughts on the Perils and Delights of Contractual Boilerplate
There are likely more perils than delights to be found in contractual boilerplate. And that would be more proof that transactional lawyering is not for the “faint of heart,”[26] or, as Ken Adams prefers, “not for the faint-hearted.”[27] So we have no choice but “to think clearly and act bravely.”[28]
The truth is we need to regularly review our contractual boilerplate to ensure nothing lurking there could undermine other provisions of the agreement. And in reviewing that boilerplate, we must ensure that we are knowledgeable about some of the nuances associated with boilerplate (particularly the “encrusted” variety). As suggested in a recent law review article:
Lawyers need to [know] what boilerplate clauses were originally intended to accomplish and how they have been interpreted; they need to know what words make a difference in forum selection and governing law provisions to actually accomplish their objectives; they need to understand what a standard no-third-party beneficiary cause does and what exceptions should be built in to avoid causing more harm than good; they need to appreciate the nuances of liquidated damages provisions; they need to understand why and how no reliance clauses work to eliminate potential extra-contractual fraud claims in many states; they need to understand how courts have interpreted the supposed hierarchy of “efforts” clauses; they need to be able to confidently review an anti-assignment or change of control clause and advise on whether the contemplated deal needs consent based upon applicable caselaw; they need to understand the courts’ interpretation of standard material adverse change clauses; and yes, they need to know what each type of damage or loss included in a typical excluded loss provision might actually mean.[29]
Because you may not have learned this stuff in law school,[30] you need to ensure your in-house CLE programs are covering it; and, if you are not a member of the Jurisprudence Subcommittee of the ABA Business Law Section’s M&A Committee, where we regularly do that sort of thing based on a review of recent caselaw, you should be.
See Rissman v. Rissman, 213 F.3d 381, 385 (7th Cir. 2000) (“[T]he fact that language has been used before does not make it less binding when used again. Phrases become boilerplate when many parties find that the language serves their ends. That’s a reason to enforce the promises, not to disregard them.”); see also Silva v. Encyclopedia Britannica Inc., 239 F.3d 385, 389 (1st Cir. 2001) (“[T]hat the forum-selection clause is a ‘boilerplate’ provision does not ipso facto render it invalid. ‘It is not the law that one must bargain for each and every written term of a contract.’” (citations omitted)). ↑
Tina L. Stark, Negotiating and Drafting Contract Boilerplate §1.01, at 5 (ALM Publ’g 2003). ↑
See John F. Coyle, Interpreting Forum Selection Clauses, 104 Iowa L. Rev. 1791 (2019); see also Glenn D. West, Special Order Your Forum Selection Clause, Weil’s Glob. Priv. Equity Watch (Oct. 28, 2019). ↑
Id. at *2; Purchase and Sale Agreement, by and among Hollandia Produce Group, Inc. Employee Stock Ownership Trust, Mosaic Capital Investors I, LP, True West Capital Partners Fund II, L.P. F/K/A Seam Fund II, LP, Mosaic Capital Investors LLC, solely in its capacity as Sellers’ Representative, Hollandia Produce Group, Inc., Local Bounti Operating Company LLC, and Local Bounti Corporation, dated as of March 14, 2022, Section 8.01(a). ↑
Purchase and Sale Agreement, supra note 13, at Section 8.05(a). ↑
2025 WL 898339, at *2; Purchase and Sale Agreement, supra note 13, at Section 11.03 (emphasis added). ↑
Purchase and Sale Agreement, supra note 13, at Section 11.04. ↑
See, e.g., 13 Fletcher Corp. Forms § 61:91 (5th ed.) (“(h) any reference to a document or set of documents, and the rights and obligations of the parties under any such documents, means such document or documents as amended from time to time, and any and all modifications, extensions, renewals, substitutions, or replacements thereof”). ↑
Glenn D. West, Another Consequential Damages Redux: A Response to “Consequential Damages Clauses: Alien Vomit or Intelligent Design?,” 102 Wash. U. L. Rev. 633, 648 (2024). ↑
I do teach a course that covers this stuff at SMU Dedman School of Law. See Glenn D. West, Teaching Contract Drafting through Caselaw—A Syllabus and a Collection of My Musings About Contract Drafting Based upon Recent Cases (2023). ↑
Recently, the Court issued a ruling in In re Facebook Inc. Derivative Litigation[1] that highlights the importance of preserving personal email. That ruling, along with its practical implications, is discussed below.
I. Summary of the Case
Facts
In March 2018, news broke that Cambridge Analytica, a British data analytics firm, harvested private information of more than 50 million Facebook users without their permission.[2] Cambridge Analytica reportedly paid Meta Platforms, Inc. (“Meta”), which owns Facebook and other platforms, for information that included users’ identities, personal identifying information, friends, and “likes.”[3]
Shortly after news broke about the Cambridge Analytica data harvest, Meta issued a legal hold that advised its recipients of their obligation to preserve (among other things):
all hard copy and electronic data and documents (such as files, data tables or logs, notes, memos, spreadsheets, docs stored in Dropbox and Box, Quip, and Google or Zoho Docs), and all correspondence (such as email, instant messages, Skype messages, WhatsApp messages, FB Messages, text messages, FB Group posts, and letters).[4]
Sheryl Sandberg, then a member of Meta’s senior leadership team, received the legal hold.[5] At the time, she was the chief operating officer, a position she held until August 2022.[6] Sandberg was also on Meta’s board of directors (the “Board”), a position she held until May 2024.[7]
On April 25, 2018, litigation stemming from the Cambridge Analytica data harvest was initiated.[8] As litigation progressed, Meta reminded its document custodians about the legal hold.[9] When a new director (Jeffrey Zients) joined the Board in 2018, Meta sent him the legal hold.[10]
Outside counsel spoke with Sandberg and Zients, both of whom were defendants in the litigation, about document preservation and collection.[11] They also received “FAQs Regarding Legal Holds,” which emphasized the obligation to preserve “‘any information related to the Matter,’” including information on personal devices and accounts.[12]
In discovery, plaintiffs asked defendants to disclose information about their preservation and collection of electronically stored information. While interrogatory responses disclosed that Sandberg had a practice prior to the litigation of regularly deleting emails from her Gmail account that were over thirty days old,[13] Sandberg’s counsel—as characterized by the Court—was not forthcoming with certain information about the preservation of her personal Gmail account and could not provide a specific date by when Sandberg ceased this practice.[14] As to Zients, counsel disclosed that he had an auto-delete function enabled that deleted email approximately every six months.[15]
Sandberg’s and Zients’s counsel investigated whether deleted emails could be obtained from other sources.[16] They reviewed emails from Sandberg’s Gmail account and documents obtained from her in connection with other litigation.[17] None were responsive.[18] Counsel was able to identify fifty-seven emails in the litigation record that were sent to or from Sandberg’s Gmail account.[19] For Zients, counsel reviewed documents from Zients’s other accounts and identified 415 that were sent to or from his personal account.[20]
Plaintiffs moved for sanctions for spoliation.[21]
Relevant Rulings
On January 21, 2025, the Court ruled on the sanctions motion, holding that Sandberg and Zients had “an affirmative duty to preserve their personal emails as evidence”— which neither contested.[22] Both, as noted above, received litigation holds and were advised by their counsel to preserve personal email, but did not.
The Court held that while counsel was able to identify some deleted email, the balance was lost and could “support a spoliation sanction.”[23]
The Court then considered whether the emails were lost due to a failure to take reasonable preservation steps. In doing so, the Court noted that individuals, like organizations,
must disable auto-delete functions that would otherwise destroy emails or texts. They also must back up data from personal devices before disposing of them. Failing to disable the auto-delete setting or back up messages before deletion demonstrates that a defendant acted unreasonably. Individuals may not claim ignorance. After receiving a litigation hold, an individual must take steps to determine what is necessary to comply. This includes learning what is necessary to prevent destruction or automatic deletion.[24]
“Under these principles,” [25] the Court held that Sandberg and Zients failed to take reasonable steps to preserve their personal emails. The Court inferred Sandberg was “picking and choosing which emails to delete,” and the Court found that there was a lack of “transparency” to plaintiffs’ counsel about Sandberg’s email practices.[26] Zients used an auto-delete function on his email that deleted data approximately every six months.[27]
Against this backdrop, the Court held that plaintiffs “made a showing sufficient to demonstrate prejudice” and shifted the burden to Sandberg and Zients to show lack of prejudice.[28]
Sandberg could not meet her burden “to make a convincing case against a finding of prejudice.”[29] The Court noted that a review of the documents that counsel was able to recover reflected emails discussing matters relevant to the action, such as the “reputational danger” Cambridge Analytica posed to Meta and Meta’s lagging “trust among [Facebook] regular users.”[30] As a sanction for spoliation, the Court raised Sandberg’s standard of proof by one level on any issue where she bears the burden of proof, and it awarded expenses incurred by plaintiffs in pursuing the spoliation issue against Sandberg including “for the effort required to pin down Sandberg’s positions and confirm that the ESI was not available from other sources.”[31]
Conversely, the Court held that there is less reason to think that Zients lost relevant emails, and as a result the Court did not impose sanctions against him.[32] Zients “was an outside director, not a C-suite officer, so he logically would have been less immersed in Company operations and likely received communications comparable to what other directors received.”[33] Also, he joined the Board after the Cambridge Analytica data harvest—and did not “participate in those events in real time.”[34]
II. Practical Application
How can I be certain that potentially relevant personal data is preserved? It is not uncommon for individuals to text or, as in the case of Facebook, use personal email accounts to communicate about business matters. In the context of litigation, any such potentially relevant communications must be preserved. As part of the preservation process, it is important to speak with custodians early on (and then throughout the litigation) about their preservation obligations—including discussing turning off any auto-delete functions and not actively deleting potentially relevant information.
Because a company often has less control over personal data, one option is to collect personal data to ensure that it is available, if ever needed. When considering whether to pursue this option, it is important to evaluate whether any applicable privacy laws or regulations restrict the collection of personal data.
What should I do when someone with potentially relevant personal data leaves while litigation is pending? The life cycle of litigation is often long. Indeed, Facebook began in 2018 and is still being litigated.
During the litigation life cycle, employees, officers, and directors with potentially relevant data may leave. In Facebook, Sandberg stopped being an officer and director years into the litigation.
Part of ensuring potentially relevant documents are adequately preserved can involve considering a company’s relationship with someone after they stop being associated with the company, and whether their data should be collected before they leave. For example, although Sandberg stopped being an officer and director, she remained a defendant and had to abide by discovery obligations as a party to the litigation. For individuals who are not parties to a litigation, it may be harder to access their potentially relevant personal data after they are no longer associated with the company absent an ongoing contractual agreement that would require their cooperation or a subpoena.
Do I have to disclose to opposing counsel that potentially relevant data such as personal email has been deleted? While every case is different, the Court—as evidenced by Facebook—expects transparency in discussions with opposing counsel about preservation matters, especially where there is a concern that data has been lost, destroyed, or deleted.
This article is related to a Showcase CLE program that took place at the American Bar Association Business Law Section’s 2025 Spring Meeting. All Showcase CLE programs were recorded live and will be available for on-demand credit, free for Business Law Section members.
Since returning to office in January 2025, President Donald Trump has moved quickly to put his stamp on the federal regulatory landscape. For business lawyers, the implications are broad and fast-evolving, touching everything from litigation exposure and securities regulation to political risk, capital markets, and tax planning. This article offers a practical overview of five key practice areas for business lawyers: government affairs, corporate litigation, federal securities regulation, private equity and venture capital, and taxation.
1. Government Affairs: Political Realignment and Industry-Specific Disruption
The 2024 elections delivered unified Republican control of Congress, with the GOP holding a narrow majority in the House (220 R to 213 D) and a more solid advantage in the Senate (53 R to 47 D, including two independents who caucus with Democrats). This shift, combined with Republican momentum in several state legislatures and governorships, has created a political environment highly conducive to sweeping federal policy changes and aggressive administrative action.
The Trump administration’s early moves have included a regulatory freeze, a 10-to-1 deregulation order (requiring federal agencies to eliminate ten existing regulations for every new proposed regulation), and a rollback of diversity, equity, and inclusion (“DEI”) programs across agencies and federal contractors. Select industries—particularly financial services, hospitality, and tech—are feeling the immediate impact. Recent tariff hikes on goods from China, Canada, Mexico, and the EU are further disrupting global supply chains and forcing companies to reevaluate sourcing, pricing, and international contracts.
In addition to the waves from the new executive branch, business lawyers must also navigate the ripple effects of key judicial branch decisions, including the Supreme Court cases of Loper Bright Enterprises v. Raimondo, which curbed Chevron deference, and Food and Drug Administration v. Alliance for Hippocratic Medicine, in which the Court unanimously dismissed the case on standing grounds—leaving the FDA’s regulatory authority intact, but highlighting the ongoing legal vulnerability around agency actions in politically charged areas.
2. Business and Corporate Litigation: Executive Orders and Political Exposure
Corporate litigators must navigate emerging risks arising from recent executive orders that affect law firm operations, modify federal enforcement practices, and alter established compliance frameworks. Notably, the administration has issued a wave of multiple executive directives (with no end in sight) that: (1) eliminate DEI mandates; (2) restructure digital asset regulation; and (3) penalize firms perceived to have political conflicts.
Perkins Coie, Jenner & Block, and WilmerHale are each currently litigating actions that revoked the security clearances of their attorneys and barred federal contract access. These cases will likely provide important judicial guidance on the limits of executive power in determining eligibility for federal contracting and legal access.
Broader risks for corporate clients include increased scrutiny of labor practices, trade policy violations, and supply chain transparency. To mitigate exposure, business lawyers should advise clients on proactive compliance, robust documentation, strengthened internal controls, and dispute resolution planning. Cross-functional coordination between legal, HR, and government affair teams is increasingly essential.
3. Federal Regulation of Securities: A Refocused, Leaner SEC
President Trump’s nomination of Paul Atkins to chair the Securities and Exchange Commission (“SEC”) is expected to pivot the agency toward a more streamlined regulatory approach. Even though (as of this writing) Atkins has yet to be confirmed, the SEC has already begun realigning its agenda by, among other things, dissolving the Climate and ESG (environmental, social, and governance) Task Force, scaling back SEC staff’s enforcement discretion, and prioritizing capital formation initiatives. Furthermore, the departure of more than six hundred members of the Staff, representing more than 10 percent of the SEC’s workforce, will accelerate the need to narrow regulatory focus and reallocate resources.
Securities lawyers can expect (1) less aggressive disclosure mandates (especially for ESG and climate issues); (ii) expanded accommodations for emerging growth companies and non-U.S. issuers; and (iii) renewed scrutiny of shareholder proposals, proxy advisors, and beneficial ownership reporting. Meanwhile, a newly formed Crypto Task Force is working to (finally) develop a more coherent and durable framework for digital assets, with increased engagement from the SEC staff expected in the months ahead.
In sum, the SEC is likely to offer increased engagement and guidance on priority issues, while avoiding expansive new rulemakings that extend beyond its core statutory mandate.
4. Private Equity and Venture Capital: Deregulation Meets Strategic Uncertainty
The Trump administration’s deregulatory stance offers potential benefits across the venture and private equity landscape. Legal and regulatory burdens may ease for emerging companies, corporate venture programs, and financial sponsors alike—particularly in areas like investment adviser compliance, marketing restrictions, and disclosure obligations. The administration’s focus on capital formation, reduced enforcement around ESG-related reporting, and openness to digital asset innovation create a more permissive environment for venture-backed businesses, fintech startups, and transactional activity.
While broader market volatility has spiked following recent tariff escalations and stock market declines, private capital markets remain relatively insulated. Many venture-backed and private equity portfolio companies are not directly exposed to short-term public market swings. However, the ongoing closure of the IPO window—highlighted by high-profile delays such as Klarna and other unicorns—has complicated near-term exit planning. Most market participants view the shutdown as temporary, with expectations of a rebound once macroeconomic uncertainty and policy direction stabilize, potentially within the next several months.
Despite current headwinds, many in the PE/VC community remain optimistic that a shift in antitrust policy will lead to a more permissive M&A climate. Under the prior administration, heightened Federal Trade Commission (“FTC”) scrutiny created obstacles to strategic exits, delaying liquidity events and limiting capital recycling within the ecosystem. A more deal-friendly regulatory regime should help restore exit pathways and improve certainty for acquirers, sellers, and investors alike.
At the same time, political volatility—including abrupt regulatory shifts, heightened scrutiny of ESG strategies, growing Committee on Foreign Investment in the United States (“CFIUS”) exposure, and unpredictable executive actions—has introduced new risks across the ecosystem. These are particularly pronounced in cross-border transactions, co-investment structures, and sectors involving artificial intelligence, semiconductors, and defense-adjacent technologies. Trade nationalism, scrutiny of foreign investors, and enhanced national security reviews continue to elevate uncertainty around foreign capital and global dealmaking. While such an approach may seem counterintuitive under a Republican administration, it reflects a bipartisan realignment around economic nationalism and technological sovereignty. Legal counsel should prepare clients—whether funds, startups, or strategic investors—for enhanced diligence, evolving state and federal oversight, and reputational considerations in an increasingly complex regulatory climate.
5. Taxation: Modest Tools, Big Ambitions
While the 2025 congressional budget resolution provides no reconciliation pathway for major tax cuts, the Trump administration continues to press for extending key Tax Cuts and Jobs Act (“TCJA”) provisions and introducing new exemptions, especially for businesses impacted by tariff-related pressures. Absent new legislation, changes may occur through regulatory reinterpretation, IRS enforcement reprioritization, or executive-led guidance (e.g., on Global Intangible Low-Taxed Income (“GILTI”), Base Erosion and Anti-Abuse Tax (“BEAT”), or passthroughs).
At the same time, IRS staffing reductions and lower audit rates—particularly for high-income individuals—pose compliance risks that practitioners should monitor closely. Loper Bright, already shaping administrative law more broadly, may also expose longstanding tax regulations to legal challenge, contributing to a more uncertain regulatory climate.
Business lawyers should help clients navigate timing decisions and planning strategies around asset sales, intercompany transfers, and restructurings, with special attention to evolving litigation risks and guidance gaps.
Conclusion
The Trump administration’s second term has ushered in a uniquely fast-moving and ideologically driven transformation of the legal landscape. For business lawyers, this moment demands agility, vigilance, and strategic foresight. Whether advising a public company, a startup fund, or a multinational enterprise, attorneys must prepare clients for a regulatory environment where norms are shifting, institutions are evolving, and risk is increasingly political as well as legal.
In 1996, the U.S. Congress passed the Cuban Liberty and Democratic Solidarity Act of 1996, known as the Helms-Burton Act. Title III of the Act allows U.S. companies and U.S. citizens whose property was confiscated by the Cuban government in 1959 or later to sue parties profiting from their confiscated property. By its own terms, Title III did not go into effect immediately. Rather, Congress left the discretion to activate Title III to the president. In May 2019, the president activated Title III for the first time since the Act’s enactment, and several lawsuits were filed against parties trafficking in confiscated property.
On July 30, 2024, the U.S. Court of Appeals for the D.C. Circuit decided one such case brought by Exxon Mobil against several Cuban state corporations. Exxon is now seeking review of the decision by the U.S. Supreme Court.
In 1960, Cuba’s revolutionary government confiscated Cuban assets of a subsidiary of Exxon (then known as Standard Oil). When a few years later the U.S. Congress established a mechanism to submit expropriation claims against Cuba, Exxon filed a claim with the U.S. Foreign Claims Settlement Commission, which determined Exxon suffered a loss of $72 million plus interest at 6 percent. Exxon’s lawsuit contended that the defendants currently traffic in confiscated property by participating in the oil industry and operating service stations using the property.
One of the defendants unsuccessfully moved to dismiss the complaint based on foreign sovereign immunity. The Foreign Sovereign Immunities Act (“FSIA”) generally bars U.S. courts from exercising jurisdiction over foreign sovereign entities such as the defendants in this case. As the appellate opinion described it, “The district court held that the [Helms-Burton Act] does not itself overcome a foreign sovereign’s general immunity from suit under the FSIA, and that jurisdiction in [the] case thus depend[ed] on the applicability of an FSIA exception.” The district court determined the FSIA’s commercial-activity exception applied to the action, and thus foreign sovereign immunity did not apply.
After the defendants appealed the denial of the motion to dismiss and Exxon cross-appealed the district court’s holdings, a panel of the D.C. Circuit Court of Appeals determined 2 to 1 that “plaintiffs bringing Title III actions against foreign states must satisfy one of the FSIA’s exceptions,” and that the FSIA’s expropriation exception did not apply in the circumstances but that the district court needed to further analyze whether the FSIA’s commercial-activity exception did. The senior judge dissented on all points from his two younger colleagues.
The Court of Appeals wrote that given the FSIA’s terms, the Supreme Court has “repeatedly explained” the FSIA provides the “sole basis” for obtaining jurisdiction over a foreign state in the courts of the United States. It therefore rejected Exxon’s argument that Title III of Helms-Burton independently confers jurisdiction over its action against Cuba, in agreement with the district court.
Exxon also argued its lawsuit satisfied two FSIA exceptions: the expropriation exception and the commercial-activity exception. The Court agreed with the district court the expropriation exception was inapplicable. With respect to the commercial-activity exception, the Court concluded the district court needed to undertake additional analysis before determining jurisdiction exists under the exception.
The district court had concluded that defendant CIMEX “causes a direct effect in the United States,” as required for the commercial-activity exception, “in two ways: first, by operating a remittances business that enables transfers of money from the United States to recipients in Cuba; and second, by selling goods imported from the United States at its convenience stores.”
The Court of Appeals agreed with Exxon and the district court that “the types of effects Exxon allege[d]—outflows of money from the United States and purchases of U.S. goods—can constitute direct effects in the United States.” Nevertheless, the Court vacated and remanded for the district court to further assess whether the defendant “causes” those effects and whether the effects are sufficiently “direct,” finding there were questions necessary to that determination that had not been examined by the district court. For example, regarding the remittances business, it stated, “[T]he the pertinent inquiry is whether CIMEX’s remittances operations at the four to ten stations located on former [Exxon subsidiary] property cause a direct effect in the United States—not whether CIMEX’s entire remittances business does so.”
The dissent stated, “It is true the Supreme Court and [the D.C. Circuit court] have repeatedly referred to the exclusive nature of the FSIA. But in each case [cited by the majority], Title III [of the Helms-Burton Act] did not apply for at least one of three reasons.” Either Helms-Burton did not exist at the time, it was not in effect because the president had suspended its cause of action, or “the plaintiffs’ claims did not arise out of or relate to Cuba’s confiscations.” Not one of the cases cited by the majority mentioned Title III of Helms-Burton. The dissent argued that those decisions thus could not control the issue in this case and that Title III “considered alone, deprives the Cuban defendants of immunity from suit.”
As to the expropriation exception, the majority concluded it did not apply “because, under international law, the property Cuba confiscated was owned not by Exxon but by its subsidiary.” But in Helms-Burton actions, the dissent argued, “‘the court shall accept’ claims certified by the Foreign Claims Settlement Commission ‘as conclusive proof’ of violated property rights.”
This case is at the intersection of Helms-Burton and sovereign immunity, which always presents many problems. Both of the amicus briefs filed in support of Exxon’s petition for a writ of certiorari so far have highlighted the potential for the D.C. Circuit’s decision to make it more difficult for businesses to access the remedy of Title III of the Helms-Burton Act. In the present case as well as future ones that are sure to come up in this area, such complications should be handled with great simplicity.
Connect with a global network of over 30,000 business law professionals
